Commit Graph

66007 Commits

Author SHA1 Message Date
Vincent Koc 54cc90b1b1 fix(release): publish ClawHub bootstrap artifacts immutably (#103809)
* fix(release): harden ClawHub bootstrap

* fix(release): centralize publication artifact verification

* fix(release): harden publication artifact verification

* fix(release): lock ClawHub bootstrap toolchain

* test(release): assert locked ClawHub binary

* fix(release): pack with trusted ClawHub harness

* fix(release): bound beta verifier artifact reads

* fix(release): bind target and tooling identities

* fix(release): stabilize signed package ordering

* fix(release): bind ClawHub pretag proof

* fix(release): bind ClawHub OIDC readback

* fix(release): bind ClawHub OIDC readback
2026-07-10 13:33:20 -07:00
Peter Steinberger 941bbec619 fix(cli): keep owner tools in local agent runs (#103922)
* fix(cli): preserve owner tools for local agent runs

* chore: leave changelog to release automation
2026-07-10 21:31:32 +01:00
Vincent Koc 99e1a6081b fix(gateway): restore suspension validation (#103925) 2026-07-10 13:20:45 -07:00
Josh Avant 5dffe21a12 fix(agents): preserve provider replay signatures (#103628) 2026-07-10 15:13:50 -05:00
Peter Steinberger 615a5bdb7e fix(i18n): add Meta docs glossary terms (#103923) 2026-07-10 21:10:05 +01:00
Peter Steinberger 72e6fcab8a fix(qa-matrix): preserve Unicode error previews (#103909)
Co-authored-by: lsr911 <liao.shirong@xydigit.com>
2026-07-10 20:58:38 +01:00
Peter Steinberger 1bcc4c5e70 feat(gateway): add cooperative host suspension (#103618)
* feat(gateway): add cooperative suspension preparation

* style: satisfy suspension lint checks

* test(gateway): reset work admission between shared suites

* fix(gateway): reject upgrades during suspension

* fix(gateway): preserve admitted work during suspension

* test(gateway): isolate suspension and restart state

* fix(gateway): close suspension false-ready gaps

* refactor(protocol): slim suspension declaration graph

* refactor(plugin-sdk): sever protocol registry edges

* fix(gateway): preserve admitted restart follow-ups

* fix(gateway): make suspension recovery fail closed

* fix(protocol): keep validation formatter re-export only

* test(gateway): simplify deferred fixture type

* style(gateway): clarify suspension entry name

* fix(gateway): retain detached work admission
2026-07-10 20:24:53 +01:00
Peter Steinberger fece8c9f54 fix(release): keep validation evidence immutable across reruns (#103906)
* fix(release): bind validation evidence to exact attempts

* test(release): cover exact validation attempts
2026-07-10 20:16:19 +01:00
Peter Steinberger e1934d968e fix(nodes): stop advertising a disabled browser proxy (#103894)
* fix(nodes): hide disabled browser proxy capability

* chore: defer node fix changelog to release

* chore: ratchet plugin SDK surface budget
2026-07-10 20:06:53 +01:00
Vincent Koc 69f8198ba3 fix(release): keep no-push Docker images validation-only (#103891)
* fix(release): make no-push Docker artifacts portable

* fix(release): keep no-push images validation-only
2026-07-10 12:02:57 -07:00
pick-cat fd5b121510 fix(terminal): strip no-argument C1 CSI sequences in sanitization (#103707)
* fix(terminal): strip no-argument C1 CSI sequences in sanitization

* test(agents): align shell-utils incomplete ANSI assertion with C1 CSI sanitization

* fix(terminal): parse CSI sequences without leaking output

* fix(terminal): preserve stripAnsi callback contract

* fix(terminal): sanitize Codex approval previews

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-07-10 19:57:14 +01:00
Peter Steinberger 5a48e73973 fix(macos): duplicate launches open SSH tunnels before handoff (#103892)
* fix(macos): gate tunnels behind singleton launch

* chore(macos): leave changelog to release workflow

* chore(macos): sync native i18n inventory
2026-07-10 19:54:04 +01:00
Peter Steinberger 7af7e41eed fix(ui): stop the worktrees table from always stacking inside settings (#103899) 2026-07-10 19:46:37 +01:00
Peter Steinberger 92f3c35ee9 fix(cron): keep Unicode list columns aligned (#103889)
* refactor(cron): size table cells by display width

* docs(changelog): credit cron table fix

* fix(cron): sanitize Unicode table cells

* test(cron): cover fitting ZWJ table cells

* refactor(cron): format table cells consistently
2026-07-10 19:46:26 +01:00
Vincent Koc 2a1d6e49d5 fix(ci): run Telegram release QA from trusted harness (#103207)
* fix(ci): use trusted Telegram QA harness

* fix(ci): restrict trusted Telegram QA candidate

* fix(ci): isolate trusted Telegram QA candidate

* fix(ci): harden Telegram QA process boundary

* fix(ci): pass Telegram QA release gates

* test(qa): stub Telegram env explicitly

* fix(ci): harden Telegram release QA boundary

* test(ci): harden trusted workflow and memory guards
2026-07-10 11:32:24 -07:00
Peter Steinberger 7a38f140a2 fix(node): approved local commands no longer fail identity validation (#103886)
* fix(node): preserve approval replay identity

* docs(node): explain replay identity boundary

* fix(node): reuse persisted replay identity

* chore(release): leave changelog to release automation
2026-07-10 19:31:11 +01:00
Vincent Koc b56bad33f2 fix(logging): redact Telegram tokens across chunk boundaries (#103861) 2026-07-10 11:20:46 -07:00
WhatsSkiLL eb7613cecd fix(android): ellipsize onboarding permission labels (#103649)
Co-authored-by: IWhatsskill <284122573+IWhatsskill@users.noreply.github.com>
2026-07-10 14:17:28 -04:00
Peter Steinberger 8f8934163b feat(ui): worktrees page owners and creation, structured snapshot failures, preserved-checkout cleanup (#103526)
* feat(ui): worktrees page owners and creation, structured snapshot failures, preserved-checkout cleanup

- Worktrees settings page gains an Owner column (manual/Workboard/session
  with a link into the owning chat) and a New worktree form with repo
  default, optional name, and a worktrees.branches-backed base picker
- non-forced worktrees.remove snapshot failures are a structured
  { removed: false, snapshotError } result (typed WorktreeSnapshotError in
  the service) instead of error-string sniffing in the UI
- deleting a session whose dirty/unpushed checkout was preserved now
  reports worktreePreserved through the session capability and offers an
  explicit force removal instead of silently orphaning the checkout

Part of #103431

* fix(ui): report preserved checkouts from batch session deletes

deleteMany now aggregates worktreePreserved results, and the Sessions
page surfaces one notice pointing at Settings -> Worktrees instead of
silently orphaning dirty checkouts during bulk deletion.

Part of #103431

* fix(ui): reconcile generated locale artifacts after rebase
2026-07-10 19:16:36 +01:00
Shakker e6ae79360c feat: open Settings with Shift-Command-Comma (#103870)
Open Settings from anywhere in the Control UI with Shift-Command-Comma while preserving browser-owned Command-Comma and existing shortcuts.

Prepared head SHA: 769a4fec5f
Co-authored-by: shakkernerd <165377636+shakkernerd@users.noreply.github.com>
Reviewed-by: @shakkernerd
2026-07-10 19:13:44 +01:00
Peter Steinberger ef9a94ecba docs: correct macOS node command support (#103878) 2026-07-10 19:08:21 +01:00
joshavant 5b20013399 docs(security): clarify computer act authorization 2026-07-10 13:06:53 -05:00
Peter Steinberger b91e117dcd fix(ci): select full Kova performance reports (#103863) 2026-07-10 19:01:30 +01:00
mushuiyu886 5bb5e4fb0a fix(cron): preserve UTF-16 table boundaries (#103616)
* fix(cron): preserve table Unicode boundaries

* refactor(cron): size table cells by display width

* docs(changelog): credit cron table fix

* fix(cron): sanitize Unicode table cells

* fix(cron): keep table truncation UTF-16 safe

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-07-10 18:57:15 +01:00
Peter Steinberger fd2a2411b9 feat(ui): sessions sidebar redesign with agent sections, smart groups, and draft sessions (#103498)
* feat(ui): sessions sidebar redesign with agent sections, smart groups, and draft sessions

- agents become collapsible top-level sidebar sections; expanding an agent
  browses its sessions without navigating, replacing the hidden scope select
- built-in smart groups: one section per channel (rows keep their chat
  titles), a Work section for worktree/exec-node sessions with a
  repo/branch/node subtitle, custom groups, and Chats
- session names never show raw keys or peer ids; DM fallbacks shorten ids,
  dashboard sessions read 'New session', unnamed work sessions read as
  their checkout
- one + opens the new-session draft dialog: agent, exec host (paired
  system.run nodes), folder, worktree toggle with base-branch picker
  (worktrees.branches) and optional name; the first message creates the
  session and starts the run in one sessions.create call
- custom group catalog/order moves to the gateway (sessions.groups.*) with
  a one-time localStorage migration; rename/delete update members
  server-side instead of client-side paging

Part of #103431

* fix(ui): resolve dragged sessions across browsed agent sections

Dropping a row dragged out of a non-active agent section now finds the
session in the per-agent row cache instead of only the active scope, so
the category patch is applied instead of silently doing nothing.

Part of #103431

* fix(ui): propagate group catalog changes to open clients

sessions.groups.put/rename/delete now always broadcast a groups-change
event, and the session capability reloads the gateway-owned catalog when
one arrives, so another browser's group create/reorder/rename/delete no
longer leaves this client on a stale snapshot for the rest of the
connection.

Part of #103431

* docs: restore new session dialog section after rebase

* fix(ui): translate new sidebar/session strings and refresh docs map

Real locale translations for the new-session dialog and sidebar keys
(the fallback gate requires zero recorded English fallbacks), plus the
regenerated docs map for the new Control UI section.

Part of #103431

* fix(ui): repair locale metadata after rebase conflict resolution

* fix(ui): merge mainline locale keys with the sidebar redesign strings

* fix(ui): refresh raw-copy baseline for mainline tool-card strings

* fix(ui): reconcile generated locale artifacts after rebase
2026-07-10 18:54:44 +01:00
Peter Steinberger 0855de48ec fix(agents): bind session rewrites to verified snapshots (#103848)
* fix(agents): bind session rewrites to verified snapshots

Co-authored-by: gucasbrg <buruguo2000@163.com>

* test: stabilize session rewrite race regression

---------

Co-authored-by: gucasbrg <buruguo2000@163.com>
2026-07-10 18:54:10 +01:00
Peter Steinberger b597a8d364 fix(release): restore prerelease and release validation startup (#103834)
* fix(release): split image publication from validation

* fix(ci): honor install smoke caller input

* fix(ci): harden Docker rerun targeting
2026-07-10 18:46:08 +01:00
ZOOWH 61893247ec fix(chutes): redact OAuth error response body (#103569)
* fix(chutes): redact OAuth error response body in token exchange and refresh

Replace readResponseTextLimited + raw body in error message with
extractProviderErrorDetail for bounded, redacted structured error detail.

Ref: #102953

* fix(chutes): update test assertions for extractProviderErrorDetail message format

* fix(chutes): remove unused readResponseTextLimited and CHUTES_OAUTH_ERROR_BODY_LIMIT_BYTES

* fix(chutes): normalize OAuth HTTP failures

* test(chutes): assert redaction without fixed mask

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-07-10 18:40:58 +01:00
Peter Steinberger 188535b097 fix(ui): queue chat input while reconnecting (#102781)
* fix(ui): queue chat input while reconnecting

* test(ui): strengthen offline reconnect proof

* chore: follow release-only changelog policy

* fix(ui): harden offline queue replay

* fix(ui): harden offline replay recovery
2026-07-10 18:37:46 +01:00
Peter Steinberger 5aea34ad8c fix(webui): keep tool activity paired without model calls (#103821)
* fix(webui): make tool activity rendering deterministic

* fix(protocol): remove stale tool-title models

* fix(i18n): translate tool activity labels

* fix(i18n): translate tool activity labels
2026-07-10 18:21:08 +01:00
Peter Steinberger c8ebfd8a3a fix(security): preserve UTF-16 token mask boundaries (#103843) 2026-07-10 18:20:05 +01:00
pick-cat 8a93d288e2 fix(nextcloud-talk): strip internal tool-trace banners from outbound text (#101712)
* fix(nextcloud-talk): strip internal tool-trace banners from outbound text

* fix(nextcloud-talk): sanitize inbound replies

Co-authored-by: liyuanbin <li.yuanbin1@xydigit.com>

* test(nextcloud-talk): prove low-level send text preservation

* test(nextcloud-talk): focus inbound sanitizer coverage

* fix(nextcloud-talk): report stripped replies as non-visible

* docs(changelog): note Nextcloud Talk reply sanitization

* chore: keep PR changelog-neutral

---------

Co-authored-by: Pick-cat <266665499+Pick-cat@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: liyuanbin <li.yuanbin1@xydigit.com>
2026-07-10 18:17:19 +01:00
qingminlong 3a64889d83 fix(agent-core): report correct JSONL entry line after blank rows (#103645)
* fix(agent-core): report jsonl entry physical line numbers

* fix(agent-core): preserve physical JSONL line numbers

* test(agent-core): keep JSONL cleanup lint-safe

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-07-10 18:12:56 +01:00
Peter Steinberger 091584b197 chore(swift): restore compact conditional bodies (#103832)
* style(swift): restore compact conditional bodies

* fix(ios): remove redundant startup timeout await

* chore(swift): sync native i18n inventory
2026-07-10 18:12:00 +01:00
Peter Steinberger 906f1b816f fix(ci): update Kova performance model owners (#103839) 2026-07-10 18:08:37 +01:00
Peter Steinberger 5166967ace fix(plugins): harden official ClawHub provenance (#103836)
Co-authored-by: Jimmy Puckett <jimmy.puckett@spinen.com>
2026-07-10 18:07:17 +01:00
Peter Steinberger 050177c784 fix(clawdock): scope confirmation response (#103837) 2026-07-10 18:06:06 +01:00
cavit99 5e250aac74 fix: A2A handoffs can duplicate message-tool replies (#97259)
* fix: stop A2A source-reply mirror duplicates

* fix(agents): harden A2A reply extraction

* fix(agents): preserve internal A2A source replies

* test(gateway): assert A2A mirror projection precisely

* test(agents): complete A2A payload fixtures

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-07-10 18:05:51 +01:00
Peter Steinberger 6154a42c0f test(audit): prove invalid date filters stop before RPC (#103833) 2026-07-10 18:03:22 +01:00
qingminlong 1d3d743b24 fix(grep): stop searches when canceled during tool startup (#103709)
* fix(grep): stop before ripgrep when aborted during setup

* fix(grep): check cancellation before ripgrep spawn

* fix(grep): make cancellation own process lifecycle

Co-authored-by: qingminlong <qing.minlong@xydigit.com>

* test(grep): use bound lifecycle assertions

Co-authored-by: qingminlong <qing.minlong@xydigit.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-07-10 18:01:59 +01:00
qingminlong bf02b611eb fix(sessions): reject malformed history offsets (#103594)
* fix(sessions): reject malformed history offsets

* test(sessions): prove invalid offsets stop before reads

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-07-10 18:00:31 +01:00
pick-cat 586df58bcc fix: allow stopping manual compaction (#90821)
* fix(compact): make queued manual compaction abortable

* fix(compact): own manual compaction lifecycle

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-07-10 17:59:27 +01:00
xingzhou 8d5f7e27b2 fix(sms): replayed Twilio webhooks process again after high inbound traffic (#101107)
* fix(sms): replayed Twilio webhooks process again after high inbound traffic

* fix(sms): harden Twilio replay saturation

* test(sms): expose response header spy

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-07-10 17:58:53 +01:00
Peter Steinberger baea671ef3 fix(anthropic): delegate adaptive Claude CLI effort (#103815)
* fix(anthropic): delegate adaptive CLI effort

Strip static --effort args for adaptive runs so Claude Code resolves effort from its environment, settings, and model default. Preserve configured effort for off or absent thinking and replace it only for concrete OpenClaw levels.

Fixes #103245

Co-authored-by: Dan Korotin <korotin.daniil@gmail.com>

* fix(anthropic): make effort dispatch exhaustive

---------

Co-authored-by: Dan Korotin <korotin.daniil@gmail.com>
2026-07-10 17:57:50 +01:00
gucasbrg 2e742e3f8e fix(embedded-agent-runner): treat the run's own no-op in-place session rewrite as benign (#91797)
* fix(agents): accept byte-identical session rewrites

Co-authored-by: gucasbrg <buruguo2000@163.com>

* chore: keep changelog release-owned

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-07-10 17:57:25 +01:00
Dallin Romney 0b9c2e6f95 fix(qa): simplify smoke lanes and isolate fanout (#102262)
* fix(qa): simplify smoke lanes and isolate fanout

* ci: re-enable repaired QA smoke lanes

* ci: split Crabline smoke into three shards

* ci: eliminate repeated QA smoke builds

* fix(qa): focus control ui smoke scenario

* ci(qa): remove smoke worker launch delay

* ci(qa): bound automatic smoke coverage
2026-07-10 09:48:40 -07:00
Peter Steinberger c08599c17b fix(clawdock): preserve sourced zsh PATH (#103805)
Co-authored-by: wenhua <lshgdut@qq.com>
2026-07-10 17:46:08 +01:00
Peter Steinberger 5c260940bd fix: prevent CLI MCP children from widening sandbox tools (#103822)
* fix(gateway): bind CLI MCP grants to context

* chore: leave release changelog ownership intact
2026-07-10 17:44:29 +01:00
Peter Steinberger e484bdd993 fix(memory-host): keep redacted token hints UTF-16 safe (#103813)
Completes the sibling memory-host masker missed by #103341.

Co-authored-by: 张贵萍0668001030 <zhang.guiping@xydigit.com>
2026-07-10 17:43:37 +01:00
WhatsSkiLL 1754292217 [AI-assisted] Tidy Android Sessions row affordances (#103108)
* fix(android): clean up Sessions row visuals

* chore(android): refresh native i18n inventory

* fix(android): consolidate session sorting controls

---------

Co-authored-by: IWhatsskill <284122573+IWhatsskill@users.noreply.github.com>
2026-07-10 12:43:18 -04:00